Existing ordinances can regulate AI models, says privacy watchdog

Rachael Ng

Ada Chung Lai-ling, the Privacy Commissioner for Personal Data, said that while there is no specific legislation governing the development of artificial intelligence models, existing laws can still address these issues.

The Office of the Privacy Commissioner for Personal Data, in collaboration with 15 privacy and data protection authorities worldwide, on Tuesday released a joint statement regarding data scraping and privacy protection on social media platforms.

The signatories of this statement include authorities from Argentina, Australia, Canada, Colombia, Guernsey, Israel, Jersey, Mexico, Monaco, Morocco, New Zealand, Norway, Spain, Switzerland and the United Kingdom.

Data scraping, which typically involves the automated extraction of information - especially for training AI systems - raises significant privacy concerns, according to the watchdog.

The statement was directed at major social media platforms, including X, LinkedIn, and Meta Platforms (Instagram, WhatsApp and Facebook).

Chung said the statement was prompted by observations of social media and websites utilizing users' data for training AI.

She said "generative AI models require vast amounts of personal data, much of which is readily accessible from public sources on the internet, leading to extensive data retrieval from social media platforms."

The purpose of the statement is to "remind social media platforms to ensure that personal data is adequately protected from illegal data extraction and to provide clear guidelines for the industry."

Data retrieval can also involve personal data that may be sold on the dark web without the consent of the data subjects.

Such breaches can lead to targeted cyberattacks, identity theft and spam-related issues.

Chung urged organizations to comply with data protection laws and relevant guidelines, saying: "Although there is no legislation specifically targeting artificial intelligence in Hong Kong, this does not rule out the regulation of AI development and usage under existing laws."

She said the Personal Data (Privacy) Ordinance and the Copyright Ordinance are already applicable.

Chung believes the SAR can shape its regulatory future by examining the approaches taken by other jurisdictions.

She also advised organizations to adopt multiple security measures and regularly review and update them to ensure data security.

rachael.ng@singtaonewscorp.com